Com­ment: a “broad” new hack­ing attack, involv­ing China but cen­tered in Ger­many, has pen­e­trated the data­bases of numer­ous cor­po­ra­tions. In FTR #699, we exam­ined Ger­man anx­i­ety about U.S. cozi­ness with China. Fol­low­ing the hack­ing attack (ear­lier this year) on Google, among other firms, rela­tions between the U.S. and China became strained. Obama is now meet­ing with the Dalai Lama, whose coun­sel he had pre­vi­ously shunned.

Might the hack­ing attacks have been a Ger­man gam­bit to effect dis­tance between the U.S. and the People’s Repub­lic of China?

“Broad New Hack­ing Attack Detected” by Siob­han Gor­man; Wall Street Jour­nal; 2/18/2010.

Hack­ers in Europe and China suc­cess­fully broke into com­put­ers at nearly 2,500 com­pa­nies and gov­ern­ment agen­cies over the last 18 months in a coor­di­nated global attack that exposed vast amounts of per­sonal and cor­po­rate secrets to theft, accord­ing to a computer-security com­pany that dis­cov­ered the breach.

A global hack­ing offen­sive has bro­ken into U.S. com­pa­nies and gov­ern­ment agen­cies. Cyber attacks could soon be seen as a national secu­rity threat, WSJ exec­u­tive edi­tor Jerry Seib tells the News Hub.

The dam­age from the lat­est cyber­at­tack is still being assessed, and affected com­pa­nies are still being noti­fied. But data com­piled by NetWit­ness, the closely held firm that dis­cov­ered the breaches, showed that hack­ers gained access to a wide array of data at 2,411 com­pa­nies, from credit-card trans­ac­tions to intel­lec­tual property.

The hack­ing oper­a­tion, the lat­est of sev­eral major hacks that have raised alarms for com­pa­nies and gov­ern­ment offi­cials, is still run­ning and it isn’t clear to what extent it has been con­tained, NetWit­ness said. Also unclear is the full amount of data stolen and how it was used. Two com­pa­nies that were infil­trated, phar­ma­ceu­ti­cal giant Merck & Co. and Car­di­nal Health Inc., said they had iso­lated and con­tained the problem.

Start­ing in late 2008, hack­ers oper­at­ing a com­mand cen­ter in Ger­many got into cor­po­rate net­works by entic­ing employ­ees to click on con­t­a­m­i­nated Web sites, email attach­ments or ads pur­port­ing to clean up viruses, NetWit­ness found.

In more than 100 cases, the hack­ers gained access to cor­po­rate servers that store large quan­ti­ties of busi­ness data, such as com­pany files, data­bases and email.

They also broke into com­put­ers at 10 U.S. gov­ern­ment agen­cies. In one case, they obtained the user name and pass­word of a soldier’s mil­i­tary email account, NetWit­ness found. A Pen­ta­gon spokesman said the mil­i­tary didn’t com­ment on spe­cific threats or intrusions.

At one com­pany, the hack­ers gained access to a cor­po­rate server used for pro­cess­ing online credit-card pay­ments. At oth­ers, stolen pass­words pro­vided access to com­put­ers used to store and swap pro­pri­etary cor­po­rate doc­u­ments, pre­sen­ta­tions, con­tracts and even upcom­ing ver­sions of soft­ware prod­ucts, NetWit­ness said.

Data stolen from another U.S. com­pany pointed to an employee’s appar­ent involve­ment in crim­i­nal activ­i­ties; author­i­ties have been called in to inves­ti­gate, NetWit­ness said. Crim­i­nal groups have used such infor­ma­tion to extort sen­si­tive infor­ma­tion from employ­ees in the past.

The spy­ware used in this attack allows hack­ers to con­trol com­put­ers remotely, said Amit Yoran, chief exec­u­tive of NetWit­ness. NetWit­ness engi­neer Alex Cox said he uncov­ered the scheme Jan. 26 while installing tech­nol­ogy for a large cor­po­ra­tion to hunt for cyberattacks.

That dis­cov­ery points to the grow­ing num­ber of attacks in recent years that have drafted com­put­ers into cyber armies known as botnets—intrusions not blocked by stan­dard antivirus soft­ware. Researchers esti­mate mil­lions of com­put­ers are con­scripted into these armies.

“It high­lights the weak­nesses in cyber secu­rity right now,” said Adam Mey­ers, a senior engi­neer at gov­ern­ment con­trac­tor SRA Inter­na­tional Inc. who reviewed the NetWit­ness data. “If you’re a For­tune 500 com­pany or a gov­ern­ment agency or a home DSL user, you could be suc­cess­fully victimized.”

Dis­clo­sure of the attack comes on the heels of Google Inc.‘s alle­ga­tion that it and more than 20 other com­pa­nies were breached by Chi­nese hack­ers. This oper­a­tion appears to be more far-reaching, infil­trat­ing some 75,000 com­put­ers and touch­ing 196 coun­tries. The high­est con­cen­tra­tions of infected com­put­ers are in Egypt, Mex­ico, Saudi Ara­bia, Turkey and the U.S.

NetWit­ness, based in Hern­don, Va., said it was shar­ing infor­ma­tion with the com­pa­nies infected. Mr. Yoran declined to name them. The com­pany pro­vides com­puter secu­rity for U.S. gov­ern­ment agen­cies and com­pa­nies. Mr. Yoran is a for­mer Air Force offi­cer who also served as cyber secu­rity chief at the Depart­ment of Home­land Security.

Besides Merck and Car­di­nal Health, peo­ple famil­iar with the attack named sev­eral other com­pa­nies infil­trated, includ­ing Para­mount Pic­tures and soft­ware com­pany Juniper Net­works Inc.

Merck said in a state­ment that one com­puter had been infected. It said it had iso­lated the attack and that “no sen­si­tive infor­ma­tion was compromised.”

Car­di­nal said it removed the infected com­puter from its net­work. Para­mount declined to com­ment. Juniper’s secu­rity chief, Barry Greene, wouldn’t speak about any spe­cific inci­dents but said the com­pany worked aggres­sively to counter infections.

NetWit­ness, which does exten­sive work for the U.S. gov­ern­ment and private-sector clients, said it was shar­ing its infor­ma­tion with the Fed­eral Bureau of Inves­ti­ga­tion. The FBI said it received numer­ous alle­ga­tions about poten­tial com­pro­mises of net­work sys­tems and responded promptly, in coor­di­na­tion with law-enforcement partners.

The com­put­ers were infected with spy­ware called ZeuS, which is avail­able free on the Inter­net in its basic form. It works with the Fire­Fox browser, accord­ing to computer-security firm Secure­Works. This ver­sion included a $2,000 fea­ture that works with Fire­Fox, accord­ing to SecureWorks.

Evi­dence sug­gests an East­ern Euro­pean crim­i­nal group is behind the oper­a­tion, likely using some com­put­ers in China because it’s eas­ier to oper­ate there with­out being caught, said NetWitness’s Mr. Yoran.

There are some elec­tronic fin­ger­prints sug­gest­ing the same group was behind a recent effort to dupe gov­ern­ment offi­cials and oth­ers into down­load­ing spy­ware via emails pur­port­ing to be from the National Secu­rity Agency and the U.S. mil­i­tary, NetWitness’s Mr. Yoran said.

That attack was described in a Feb. 5 report from the Depart­ment of Home­land Secu­rity, which said it was issu­ing an alert to the gov­ern­ment and other orga­ni­za­tions to “pre­vent fur­ther compromises.”

A DHS offi­cial said that ZeuS was among the top five reported tools for mal­ware infections.